jb-11-09

Author: American-Dipper

articles/application-gateway/application-gateway-create-gateway-ilb-ase.md

@@ -0,0 +1,71 @@
+---
+title: Create an Application Gateway – ILB ASE | Microsoft Docs
+description: Learn how to troubleshoot an application gateway by using an Internal Load Balancer with an App Service Environment in Azure
+services: vpn-gateway
+documentationCenter: na
+author: genlin
+manager: cshepard
+editor: ''
+tags: ''
+
+ms.service: vpn-gateway
+ms.devlang: na
+ms.topic: troubleshooting
+ms.tgt_pltfrm: na
+ms.workload: infrastructure-services
+ms.date: 11/06/2018
+ms.author: genli
+---
+
+# Back-end server certificate is not whitelisted for an application gateway using an ILB ASE
+
+This article troubleshoots the issue in which a certificate isn't whitelisted when you create an application gateway by using an Internal Load Balancer (ILB) together with an App Service Environment (ASE) at the back end with end-to-end SSL in Azure.
+
+## Symptoms
+
+When you create an application gateway by using an ILB with an ASE at the back end, the back-end server may become unhealthy. This problem occurs if the authentication certificate of the application gateway doesn't match the configured certificate on the back-end server. See the following scenario as an example:
+
+**Application Gateway configuration:**
+
+- **Listener:** Multi-site
+- **Port:** 443
+- **Hostname:** test.appgwtestase.com
+- **SSL Certificate:** CN=test.appgwtestase.com
+- **Backend Pool:** IP address or FQDN
+- **IP Address:**: 10.1.5.11
+- **HTTP Settings:** HTTPS
+- **Port:**: 443
+- **Custom Probe:** Hostname – test.appgwtestase.com
+- **Authentication Certificate:** .cer of test.appgwtestase.com
+- **Backend Health:** Unhealthy – Backend server certificate is not whitelisted with Application Gateway.
+
+**ASE configuration:**
+
+- **ILB IP:** 10.1.5.11
+- **Domain name:** appgwtestase.com
+- **App Service:** test.appgwtestase.com
+- **SSL Binding:** SNI SSL – CN=test.appgwtestase.com
+
+When you access the application gateway, you receive the following error message because the back-end server is unhealthy:
+
+**502 – Web server received an invalid response while acting as a gateway or proxy server.**
+
+## Solution
+
+If you don't use a host name to access a HTTPS website, the back-end server will return the configured certificate on the default website. For an ILB ASE, the default certificate comes from the ILB certificate. If there are no configured certificates for the ILB, the certificate comes from the ASE App certificate.
+
+When you use a fully qualified domain name (FQDN) to access the ILB, the back-end server will return the correct certificate that's uploaded in the HTTP settings. In this case, consider the following options:
+
+- Use FQDN in the back-end pool of the application gateway to point to the IP address of the ILB. This option only works if you have a private DNS zone or a custom DNS configured. Otherwise, you have to create an "A" record for a public DNS.
+
+- Use the uploaded certificate on the ILB or the default certificate in the HTTP settings. The application gateway gets the certificate when it accesses the ILB's IP for the probe.
+
+- Use a wildcard certificate on the ILB and the back-end server.
+
+- Clear the **Use for App service** option for the application gateway.
+
+To reduce overhead, you can upload the ILB certificate in the HTTP settings to make the probe path work. (This is just for whitelisting. It won't be used for SSL communication.) The ILB certificate can be retrieved by accessing the ILB with its IP address on HTTPS, then exporting the SSL certificate in a Base-64 encoded CER format and uploading the certificate on the respective HTTP settings.
+
+## Need help? Contact support
+
+If you still need help, [contact support](https://portal.azure.com/?#blade/Microsoft_Azure_Support/HelpAndSupportBlade) to get your issue resolved quickly.

articles/application-gateway/toc.yml

@@ -29,6 +29,8 @@
     href: tutorial-url-redirect-cli.md
   - name: Autoscaling and zone redundant
     href: tutorial-autoscale-ps.md
+  - name: Create an Application Gateway – ILB ASE
+    href: application-gateway-create-gateway-ilb-ase.md
 - name: Samples
   items:
   - name: Azure PowerShell